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REMARKS/ARGUMENTS 

Reconsideration and allowance of the subject application are respectfully requested. 

Claims 28-82 stand objected to because of improper claim numbering. The remaining 
pending claims have been renumbered in accordance with the Examiner's suggestion. 
Withdrawal of the objection to these claims is respectfully requested. 

Claim 43 stands rejected under 35 USC §112, second paragraph, for indefiniteness. 
Original claim 43 renumbered as claim 42 now depends from renumbered claim 41 which 
provides antecedent basis for the higher level security mode and the lower level security mode. 
Withdrawal of the rejection under 35 USC §112, second paragraph, is requested. 

Claims 1-13, 16-24, 28-41, 44-52, 55-68, 71-79 and 82 stand rejected under 35 USC 
§102 as being anticipated by U.S. Patent 6,195,587 to Hruska et al. This rejection is respectfully 
traversed. 

To establish that a claim is anticipated, the Examiner must point out where each and 
every limitation in the claim is found in a single prior art reference. Scripps Clinic & Research 
Found, v. Genentec, Inc., 927 F.2d 1565 (Fed. Cir. 1991). Every limitation contained in the 
claims must be present in the reference, and if even one limitation is missing from the reference, 
then it does not anticipate the claim. Kloster Speedsteel AB v. Crucible, Inc., 793 F.2d 1565 
(Fed. Cir. 1986). Hruska fails to satisfy this rigorous standard. 

Claims 1-6, 29-34 and 56-61 have been cancelled, and independent claims 7, 17, 34, 44, 
61, and 71 include the feature that the assessment computer stores a database of computer files 
including for each computer file a persistence flag indicating whether an entry relating to a 
computer file should be purged from the database. An example of such a persistence flag is 
illustrated in Figure 5 and described on page 8, lines 13-15 of the instant application. The 
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Hruska patent does not disclose or suggest such a persistence flag or purging a database of 
computer files. 

With respect to claims 13 and 24 in paragraph 19 of the Official Action, the Examiner 
contends that Hruska teaches such features, citing column 5, lines 14-18 and 22-25. This text 
merely describes calculating an authorized file's checksum and adding it to a list of checksums 
of authorized files followed by a report to the workstation indicating that access to the file can be 
allowed. This text does not describe (1) a persistence flag in addition to a checksum or (2) 
purging a database of computer files. 

As explained in the application, the advantage of a persistence flag is that user-specified 
white list or black list entries (e.g., as a result of a policy concerning banned or permitted 
applications that may be run) can be preserved within the database while entries relating to 
results of malware scanning can be purged as necessary. One purging example is when a virus 
definition update occurs. The scan-related results based on the old version of virus definitions 
will no longer be valid because those scans using the old virus definitions may not have 
identified newly-released viruses. Indeed, the newly-released viruses are typically the most 
dangerous. Because new viruses are rapidly released, virus definition databases must be 
frequently updated. As a result, the reduction in workload achieved by purging inappropriate 
entries from the database is quite beneficial. Hruska does not achieve these benefits. 

The application is in condition for allowance. An early notice to that effect is earnestly 
solicited. 
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